Last updated: September 12, 2026
This Privacy Policy explains how Virtual Brick, doing business as Bayon AI ("Bayon AI," "we," "us," or "our"), handles personal information when you use GuruAI or WonderGuide, including our websites, progressive web apps, and mobile applications (together, the "Services").
Bayon AI provides AI-assisted conversations for guidance, reflection, and personal development. Questions about this notice or privacy requests can be sent to privacy@bayonai.com.
1. The most important points
- Your prompts, conversation history, memories, profile details, and files may contain personal or sensitive information. Submit only information you are comfortable having processed as described here.
- We use OpenAI or Anthropic commercial APIs to generate AI responses. We do not use your content to train our own AI models, and we do not opt in to provider programs that use API customer content for model training.
- We do not sell personal information, share it for cross-context behavioral advertising, or serve targeted advertising.
- You can ask to access, correct, export, or delete your information by emailing us. Memory controls in the Services provide additional ways to review, export, and delete saved memories.
2. Information we collect
Account and authentication information
You may use some features without an account. If you create or use an account, we process a Firebase user ID, email address, display name, profile image, authentication provider, session information, and related security metadata. Sign-in is available by email link or Google. We do not receive your Google password.
Conversations, AI content, and memories
We process prompts, conversation messages, selected agents, selected or assigned AI models, generated responses, conversation identifiers, and feedback needed to provide chat. If memory is enabled, saved preferences, goals, facts, instructions, and memory settings may be stored so they can assist your agents within the same organization. Generated responses may be retained with the conversation for signed-in users.
Profile information
You may choose to save a biography and custom labels or values. Depending on the app version and feature availability, profile data may also include a display name, social profile links, date of birth, or birth time. These optional fields can reveal sensitive information; you do not need to provide them to use basic chat.
Files and generated media
Where file upload is available, we process the file, filename, content type, size, storage identifier, and ownership metadata. Current GuruAI chat uploads accept selected image and text formats. Files may be provided to the selected AI provider when needed to answer your request. AI-generated text or media is probabilistic and may be inaccurate, incomplete, or misleading. Generated images are synthetic and should not be treated as photographs of real people, events, or places without independent verification.
Contact and support information
If you contact us, we process your name, email address, message, and related correspondence. When GuruAI sends an email sign-in link, it may also send a masked form of the email address to our private Slack workspace as an operational sign-in notice.
Subscription information
If GuruAI subscription checkout is available and you choose to use it, Paddle receives the payment and billing information you enter at checkout. We receive and store limited transaction, customer, subscription, status, and entitlement identifiers needed to provide and administer paid access. Bayon AI does not receive or store your full payment-card number.
Usage and technical information
Our systems and service providers may process IP address, request time, browser or app version, device and operating-system information, referring page, pages viewed, session activity, approximate location derived from IP address, security events, error codes, response timing, and aggregate feature usage. PostHog events are designed to exclude chat text, file contents, contact details, credentials, request or response bodies, and error stacks. When signed in, the Firebase user ID may be used as the PostHog account identifier.
Information stored on your device
The Services use local storage, IndexedDB, cookies, and service-worker caches for sign-in, preferences, rate limiting, offline operation, and static assets. WonderGuide may store display-layout and suggestion-favorite preferences locally. If voice dictation is available, it uses your browser or operating system's speech-recognition service; Bayon AI receives the resulting text, not a recording from that browser feature. Your device or browser provider may process audio under its own privacy terms.
What we do not collect for the Services
We do not ask for contact lists, address books, precise GPS location, government identifiers, or passwords for Google accounts. We do not intentionally collect biometric identifiers or use the Services to determine eligibility for employment, housing, credit, insurance, or other high-impact decisions.
3. How we use information
- Provide authentication, conversations, uploads, profiles, memories, subscriptions, support, and requested AI features.
- Maintain security, prevent abuse and fraud, enforce usage limits, diagnose failures, and protect users and the Services.
- Measure aggregate usage, operate feature flags, and improve reliability and user experience.
- Communicate about service requests, account matters, material policy changes, and support.
- Comply with law, respond to valid legal process, and establish or defend legal claims.
4. AI processing and model training
The Bayon AI backend sends the conversation context needed for a response to the provider assigned to the selected agent. Current integrations support OpenAI GPT models and Anthropic Claude models. OpenAI may also process saved memories to generate embeddings or extract user-requested memory. The model and provider may change when an agent configuration changes.
Bayon AI does not use your prompts, files, memories, or model outputs to train our own AI models and does not opt in to sharing commercial API content for provider model training. OpenAI and Anthropic state that commercial API customer content is not used for model training unless the customer explicitly opts in. Providers may retain limited content and metadata for safety, abuse prevention, legal compliance, or service operation under their commercial terms and the account controls available to Bayon AI.
5. Legal bases
Where applicable law requires a legal basis, we rely on:
- Contract: to provide features you request and administer your account or subscription.
- Legitimate interests: to secure, maintain, troubleshoot, and improve the Services without overriding your rights.
- Consent: where required for optional analytics, device permissions, or communications. You may withdraw consent at any time.
- Legal obligation: when processing is necessary to comply with applicable law.
6. Cookies and local storage
| Technology | Purpose | Typical duration | Your choices |
|---|---|---|---|
| Firebase authentication storage and cookies | Keep you signed in and protect authentication flows. | Session or provider-configured duration. | Sign out or clear site/app data; authentication will stop working. |
emailForSignIn | Temporarily completes email-link sign-in. | Removed after the sign-in callback succeeds. | Clear local storage; email-link sign-in may need to be restarted. |
signin_attempts | Applies the local one-hour sign-in attempt limit. | One hour, unless cleared earlier. | Clear local storage. |
| User preferences | Stores layout, suggestion favorites, and recent local selections. | Until changed or site/app data is cleared. | Use in-app controls or clear local storage. |
| User-scoped conversation read cache | Provides a limited offline copy of the latest signed-in conversation. | 20 minutes; also cleared on sign-out or account switch. | Sign out or clear browser storage. |
| Static-asset and PWA caches | Make code, fonts, images, and other non-private assets load reliably. | Up to 30 days. | Clear site/app data or remove the installed app. |
PostHog identifiers such as ph_* | Measure product usage and feature-flag exposure when PostHog is configured. | According to the PostHog project and browser settings. | Block analytics storage or clear site data. |
Google Analytics identifiers such as _ga and _ga_* | Measure page and session activity when Google Analytics is configured. | Up to two years, subject to our configuration and your browser settings. | Use the Google Analytics opt-out add-on, block analytics cookies, or clear site data. |
We do not use advertising cookies or cross-site advertising trackers. The Services do not currently provide a separate response to the browser's optional Do Not Track signal because there is no consistent industry standard for it. Browser blocking and applicable consent controls still apply.
7. When we disclose information
We disclose information only as needed to provide the Services, complete a transaction you request, protect the Services, comply with law, or complete a corporate transaction. We do not sell personal information or share it for cross-context behavioral advertising.
| Provider | Purpose and information involved | Provider privacy information |
|---|---|---|
| Google Cloud and Firebase | Authentication, Google sign-in, email-link delivery, Firestore and Realtime Database, file storage, backend compute, security logs, Google Analytics when configured, and Google Fonts. Depending on the feature, this can involve account data, content, files, IP address, device data, and usage data. | Firebase privacy and security and Google Privacy Policy |
| OpenAI | GPT-based chat, memory extraction and embeddings, and supported media generation or transcription. Receives the content and context needed for the request. | OpenAI Privacy Policy and enterprise privacy |
| Anthropic | Claude-based chat when the selected agent is configured to use Anthropic. Receives the content and context needed for the request. | Anthropic Privacy Center |
| PostHog | Product analytics and feature flags when configured. Receives approved usage events and may receive the Firebase user ID for signed-in analytics identity. | PostHog Privacy Policy |
| Vercel | Hosts and delivers the web applications. WonderGuide also uses Vercel Speed Insights. Vercel may process requests, IP addresses, device data, performance data, and logs. | Vercel Privacy Notice |
| Paddle | Creates and processes GuruAI subscription checkout when enabled, including billing, payment, tax, fraud-prevention, and transaction data. | Paddle Privacy Policy |
| Slack | Receives a masked email indicator for GuruAI email-link sign-in operational notices. It does not receive the full address through this flow. | Slack Privacy Policy |
| Apple App Store and Google Play | Distribute mobile applications and independently process store account, download, purchase, device, and diagnostic information under their own terms. | Apple Privacy Policy and Google Privacy Policy |
8. Retention
- Account, profile, conversations, memories, attachments, and subscription records: retained while needed to provide the relevant feature, until deleted through available controls or a verified privacy request, and as needed for security, disputes, tax, or legal obligations. Some backup copies may remain for a limited recovery period.
- OpenAI API content: may be kept in abuse-monitoring logs for up to 30 days unless a different approved retention control applies or longer retention is legally required.
- Anthropic API content: retained according to the commercial service configuration and terms that apply to our account.
- Contact and support records: retained while the request is active and afterward as reasonably needed for follow-up, security, disputes, and legal obligations.
- Analytics and infrastructure logs: retained according to the configured provider project and operational security settings. Aggregate reports may no longer identify an individual.
- On-device data: follows the specific durations in the table above and can be removed by clearing site/app data.
9. Your privacy rights and choices
Depending on your location, you may have rights to access, know about, correct, delete, restrict, or obtain a portable copy of personal information; object to certain processing; withdraw consent; and appeal a denied request. You may also opt out of the sale or sharing of personal information, although Bayon AI does neither as those terms are defined by applicable US state privacy laws.
Email privacy@bayonai.com to exercise a right. We may verify your identity and authority before acting. You may use an authorized agent where local law permits. We will respond within the period required by applicable law, generally within 30 days for EEA/UK requests and 45 days for many US state requests, subject to permitted extensions. You may complain to your local data-protection or consumer-protection authority.
10. International transfers
Bayon AI and its providers may process information in the United States, the European Economic Area, Asia, and other locations where they operate. Firebase Authentication is operated from US data centers, while other Firebase and cloud services may use regional or global infrastructure. Where required, we rely on contractual safeguards such as Standard Contractual Clauses, adequacy decisions, or another lawful transfer mechanism.
11. Children
The Services are not directed to children under 13, and we do not knowingly collect personal information from them. Where local law requires parental consent for a user under 16, the user must not use the Services without that consent. Contact us if you believe a child provided information so we can investigate and delete it where required.
12. Security
We use administrative and technical safeguards designed to protect information, including HTTPS/TLS in transit, provider-managed encryption at rest for supported Firebase services, authenticated access controls, owner-scoped storage paths, and limits on information sent to analytics. No system is completely secure. If a breach creates a legally reportable risk, we will notify affected people and authorities as required by law.
13. EEA and UK supplement
For people in the EEA or UK, Bayon AI is the controller for the processing described in this notice and its providers generally act as processors or independent controllers according to their roles. The legal bases are described in Section 5. Your rights include those in Articles 15–22 of the GDPR, where applicable. You may lodge a complaint with the supervisory authority where you live or work. Contact us to request details about our representative or data protection contact if one is required for your location.
14. California and other US state supplement
The table below summarizes categories handled during the preceding 12 months. "Disclosed" means provided for a business purpose to the providers in Section 7, not sold.
| Category | Examples | Collected and disclosed |
|---|---|---|
| Identifiers and customer records | Email, name, Firebase user ID, IP address, account and provider IDs. | Yes — authentication, support, security, analytics, and account administration. |
| Commercial information | Subscription, transaction, entitlement, and purchase status. | When checkout is used — subscription delivery and administration. |
| Internet or electronic activity | Pages, interactions, device/browser data, diagnostics, and session activity. | Yes — service delivery, analytics, reliability, and security. |
| Approximate geolocation | Country or region inferred from IP address. | Yes — security, infrastructure, and analytics; no precise GPS data. |
| Audio, visual, or similar information | Images or other supported files you upload; device dictation audio is handled by your browser/provider. | When you use the relevant feature — fulfill your request. |
| Professional, education, or protected-class information | Information you voluntarily include in prompts, profile fields, files, or memories. | Only if you submit it — fulfill your request. |
| Inferences | Saved preferences or memories and AI-generated responses based on submitted context. | When memory or AI features are used — personalize and provide the requested service. |
| Sensitive personal information | Account credentials handled by Firebase, or sensitive details you voluntarily put in content. | Only as necessary to authenticate or provide the feature; not used to infer characteristics outside your request. |
| Biometric information | Biometric templates or identifiers. | No. |
We do not sell these categories and do not share them for cross-context behavioral advertising. We do not knowingly sell or share personal information of people under 16. California residents may request the categories and specific pieces collected, sources, purposes, recipient categories, correction, or deletion, and may use an authorized agent. We will not discriminate against you for exercising a privacy right.
15. Changes to this policy
We may update this notice as the Services, providers, or law changes. We will post the revised notice with a new "Last updated" date. If a change materially affects how we use information, we will provide additional notice where required, such as an in-app notice or email.
16. Contact us
Virtual Brick, doing business as Bayon AI
Email: privacy@bayonai.com
Websites: guru.bayonai.com and wonder.bayonai.com
This notice is intended to describe our current data practices clearly. It is not a substitute for advice from qualified legal counsel about requirements that apply to Bayon AI in a specific jurisdiction.